Service overview dashboard
To access this dashboard from the Kyndryl Bridge main menu, go to Services → Kyndryl Services →Security & Resiliency → Security Operations Center and click the Service Overview tab.
The Service overview dashboard includes the following widgets:
- Service Tools: A horizontal bar chart showing the number of incidents categorized by Security Orchestration, Automation, and Response (SOAR) tool types.
- Event Status: A vertical bar chart showing the count of events by status, including New, Investigating, In Progress, Pending, Resolved, Closed, and False Positive.
- MTTD: Average time taken to detect an incident, measured in hours.
- MTTResp: Average response time to an incident, measured in hours.
- MTTR: Average time taken to resolve an incident, measured in hours.
- MTTC: Average time taken to contain an incident, measured in hours.
- MTTE: Average time taken to escalate an incident, measured in hours.
- False Positives: Count of false positives flagged by a SOAR system or security analyst.
- Top 10 Event Types: A vertical bar chart showing the top ten events by source.
- Mean Time to Resolve by Tier: A horizontal bar chart displaying the average incident resolution time categorized by analyst tier.
- Event Severity: A horizontal bar chart displaying the number of incidents grouped by severity (Low, Medium, High and Critical).
- Tactic Level Breakdown: A map showing the number of security events by MITRE tactics.
- Technique Level Breakdown: A map displaying the number of security events grouped by MITRE techniques.
- SOAR Events by Day: A line chart showing daily security events processed over the specified date range.
- Events by Host: A heat map displaying the number of security events associated by host.
SOAR event details
The event details table summarizes the security events from the Security Orchestration Automation and Response (SOAR) tool, detailing type, event ID, created/modified/closed dates, detect duration, response duration, resolve duration, severity, status, category, SNOW ticket number, and a link for more details.
- Event Status: A vertical bar chart displaying the count of events by status (New, Investigating, In Progress, Pending, Resolved, Closed, and False Positive).
- Event Type: A vertical bar chart illustrating the number of security events categorized by security tool.
- Closed Reason: A horizontal bar chart displays the number of security events by their closure reason.
- Event Severity: A horizontal bar chart showing incident counts by severity levels (Low, Medium, High, and Critical).
SOAR complete incident detail
The Complete Incident Detail page in the SOAR tool summarizes the security incident. It includes the event ID, severity, status, closure reason (if applicable), and durations (in hours) for resolution, detection, response, escalation, and containment. It also includes key details such as the alert ID, ticket number, impacted host, assignee, resolver, category, MITRE tactic, MITRE technique, automation playbook ID, and creation, last modification, and closure dates.